CVE-2020-2950

CRITICAL

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion Middleware (component: Analytics Web General). Supported versions that are affected are 5.5.0.0.0, 11.1.1.9.0, 12.2.1.3.0 and 12.2.1.4.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. Successful attacks of this vulnerability can result in takeover of Oracle Business Intelligence Enterprise Edition. CVSS 3.0 Base Score 9.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Published: Apr 15, 2020 Modified: Jun 17, 2026

NVD-CWE-noinfo

CVSS Metrics

CVSSv3

Attack Vector: NETWORK Attack Complexity: LOW Privileges Required: NONE User Interaction: NONE Scope: UNCHANGED Confidentiality Impact: HIGH Integrity Impact: HIGH Availability Impact: HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected Products (4)

Vendor	Product	Version
oracle	business_intelligence	5.5.0.0.0
oracle	business_intelligence	11.1.1.9.0
oracle	business_intelligence	12.2.1.3.0
oracle	business_intelligence	12.2.1.4.0

GitHub Security Advisory GHSA-j639-c36q-pprv

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Fusion...

References (4)

https://www.oracle.com/security-alerts/cpuapr2020.html Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-505/ Third Party Advisory, VDB Entry
https://www.oracle.com/security-alerts/cpuapr2020.html Patch, Vendor Advisory
https://www.zerodayinitiative.com/advisories/ZDI-20-505/ Third Party Advisory, VDB Entry

Risk Scores

CVSS Score 9.8 / 10

EPSS Score 71.03%

Top 1% most likely to be exploited

Threat Score 70.5 / 100

Data Sources

NVD EPSS GitHub